Skip to content

Commit 3ae1bf3

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "Make more project level APIs scoped to project only"
2 parents 85a0711 + d7be635 commit 3ae1bf3

35 files changed

+1526
-1393
lines changed

‎nova/api/openstack/compute/server_groups.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ def index(self, req):
167167
# new defaults completly then we can remove the above check.
168168
# Until then, let's keep the old behaviour.
169169
context.can(sg_policies.POLICY_ROOT % 'index:all_projects',
170-
target={})
170+
target={'project_id': project_id})
171171
sgs = objects.InstanceGroupList.get_all(context)
172172
else:
173173
sgs = objects.InstanceGroupList.get_by_project_id(

‎nova/api/openstack/compute/server_topology.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ def index(self, req, server_id):
3535
target={'project_id': instance.project_id})
3636

3737
host_policy = (st_policies.BASE_POLICY_NAME % 'host:index')
38-
show_host_info = context.can(host_policy, fatal=False)
38+
show_host_info = context.can(host_policy,
39+
target={'project_id': instance.project_id}, fatal=False)
3940

4041
return self._get_numa_topology(context, instance, show_host_info)
4142

‎nova/api/openstack/compute/volumes.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -506,6 +506,11 @@ def update(self, req, server_id, id, body):
506506
# different from the 'id' in the url path, or only swap is allowed by
507507
# the microversion, we should check the swap volume policy.
508508
# otherwise, check the volume update policy.
509+
# NOTE(gmann) We pass empty target to policy enforcement. This API
510+
# is called by cinder which does not have correct project_id where
511+
# server belongs to. By passing the empty target, we make sure that
512+
# we do not check the requester project_id and allow users with
513+
# allowed role to perform the swap volume.
509514
if only_swap or id != volume_id:
510515
context.can(va_policies.POLICY_ROOT % 'swap', target={})
511516
else:

‎nova/policies/attach_interfaces.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -37,51 +37,51 @@
3737
attach_interfaces_policies = [
3838
policy.DocumentedRuleDefault(
3939
name=POLICY_ROOT % 'list',
40-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
40+
check_str=base.PROJECT_READER,
4141
description="List port interfaces attached to a server",
4242
operations=[
4343
{
4444
'method': 'GET',
4545
'path': '/servers/{server_id}/os-interface'
4646
},
4747
],
48-
scope_types=['system', 'project'],
48+
scope_types=['project'],
4949
deprecated_rule=DEPRECATED_INTERFACES_POLICY),
5050
policy.DocumentedRuleDefault(
5151
name=POLICY_ROOT % 'show',
52-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
52+
check_str=base.PROJECT_READER,
5353
description="Show details of a port interface attached to a server",
5454
operations=[
5555
{
5656
'method': 'GET',
5757
'path': '/servers/{server_id}/os-interface/{port_id}'
5858
}
5959
],
60-
scope_types=['system', 'project'],
60+
scope_types=['project'],
6161
deprecated_rule=DEPRECATED_INTERFACES_POLICY),
6262
policy.DocumentedRuleDefault(
6363
name=POLICY_ROOT % 'create',
64-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
64+
check_str=base.PROJECT_MEMBER,
6565
description="Attach an interface to a server",
6666
operations=[
6767
{
6868
'method': 'POST',
6969
'path': '/servers/{server_id}/os-interface'
7070
}
7171
],
72-
scope_types=['system', 'project'],
72+
scope_types=['project'],
7373
deprecated_rule=DEPRECATED_INTERFACES_POLICY),
7474
policy.DocumentedRuleDefault(
7575
name=POLICY_ROOT % 'delete',
76-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
76+
check_str=base.PROJECT_MEMBER,
7777
description="Detach an interface from a server",
7878
operations=[
7979
{
8080
'method': 'DELETE',
8181
'path': '/servers/{server_id}/os-interface/{port_id}'
8282
}
8383
],
84-
scope_types=['system', 'project'],
84+
scope_types=['project'],
8585
deprecated_rule=DEPRECATED_INTERFACES_POLICY)
8686
]
8787

‎nova/policies/floating_ips.py‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
floating_ips_policies = [
3939
policy.DocumentedRuleDefault(
4040
name=BASE_POLICY_NAME % 'add',
41-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
41+
check_str=base.PROJECT_MEMBER,
4242
description="Associate floating IPs to server. "
4343
" This API is deprecated.",
4444
operations=[
@@ -47,11 +47,11 @@
4747
'path': '/servers/{server_id}/action (addFloatingIp)'
4848
}
4949
],
50-
scope_types=['system', 'project'],
50+
scope_types=['project'],
5151
deprecated_rule=DEPRECATED_FIP_POLICY),
5252
policy.DocumentedRuleDefault(
5353
name=BASE_POLICY_NAME % 'remove',
54-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
54+
check_str=base.PROJECT_MEMBER,
5555
description="Disassociate floating IPs to server. "
5656
" This API is deprecated.",
5757
operations=[
@@ -60,55 +60,55 @@
6060
'path': '/servers/{server_id}/action (removeFloatingIp)'
6161
}
6262
],
63-
scope_types=['system', 'project'],
63+
scope_types=['project'],
6464
deprecated_rule=DEPRECATED_FIP_POLICY),
6565
policy.DocumentedRuleDefault(
6666
name=BASE_POLICY_NAME % 'list',
67-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
67+
check_str=base.PROJECT_READER,
6868
description="List floating IPs. This API is deprecated.",
6969
operations=[
7070
{
7171
'method': 'GET',
7272
'path': '/os-floating-ips'
7373
}
7474
],
75-
scope_types=['system', 'project'],
75+
scope_types=['project'],
7676
deprecated_rule=DEPRECATED_FIP_POLICY),
7777
policy.DocumentedRuleDefault(
7878
name=BASE_POLICY_NAME % 'create',
79-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
79+
check_str=base.PROJECT_MEMBER,
8080
description="Create floating IPs. This API is deprecated.",
8181
operations=[
8282
{
8383
'method': 'POST',
8484
'path': '/os-floating-ips'
8585
}
8686
],
87-
scope_types=['system', 'project'],
87+
scope_types=['project'],
8888
deprecated_rule=DEPRECATED_FIP_POLICY),
8989
policy.DocumentedRuleDefault(
9090
name=BASE_POLICY_NAME % 'show',
91-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
91+
check_str=base.PROJECT_READER,
9292
description="Show floating IPs. This API is deprecated.",
9393
operations=[
9494
{
9595
'method': 'GET',
9696
'path': '/os-floating-ips/{floating_ip_id}'
9797
}
9898
],
99-
scope_types=['system', 'project'],
99+
scope_types=['project'],
100100
deprecated_rule=DEPRECATED_FIP_POLICY),
101101
policy.DocumentedRuleDefault(
102102
name=BASE_POLICY_NAME % 'delete',
103-
check_str=base.PROJECT_MEMBER_OR_SYSTEM_ADMIN,
103+
check_str=base.PROJECT_MEMBER,
104104
description="Delete floating IPs. This API is deprecated.",
105105
operations=[
106106
{
107107
'method': 'DELETE',
108108
'path': '/os-floating-ips/{floating_ip_id}'
109109
}
110110
],
111-
scope_types=['system', 'project'],
111+
scope_types=['project'],
112112
deprecated_rule=DEPRECATED_FIP_POLICY),
113113
]
114114

‎nova/policies/instance_actions.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
instance_actions_policies = [
3939
policy.DocumentedRuleDefault(
4040
name=BASE_POLICY_NAME % 'events:details',
41-
check_str=base.SYSTEM_READER,
41+
check_str=base.PROJECT_ADMIN,
4242
description="""Add "details" key in action events for a server.
4343
4444
This check is performed only after the check
@@ -56,10 +56,10 @@
5656
'path': '/servers/{server_id}/os-instance-actions/{request_id}'
5757
}
5858
],
59-
scope_types=['system', 'project']),
59+
scope_types=['project']),
6060
policy.DocumentedRuleDefault(
6161
name=BASE_POLICY_NAME % 'events',
62-
check_str=base.SYSTEM_READER,
62+
check_str=base.PROJECT_ADMIN,
6363
description="""Add events details in action details for a server.
6464
This check is performed only after the check
6565
os_compute_api:os-instance-actions:show passes. Beginning with Microversion
@@ -73,30 +73,30 @@
7373
'path': '/servers/{server_id}/os-instance-actions/{request_id}'
7474
}
7575
],
76-
scope_types=['system', 'project']),
76+
scope_types=['project']),
7777
policy.DocumentedRuleDefault(
7878
name=BASE_POLICY_NAME % 'list',
79-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
79+
check_str=base.PROJECT_READER,
8080
description="""List actions for a server.""",
8181
operations=[
8282
{
8383
'method': 'GET',
8484
'path': '/servers/{server_id}/os-instance-actions'
8585
}
8686
],
87-
scope_types=['system', 'project'],
87+
scope_types=['project'],
8888
deprecated_rule=DEPRECATED_INSTANCE_ACTION_POLICY),
8989
policy.DocumentedRuleDefault(
9090
name=BASE_POLICY_NAME % 'show',
91-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
91+
check_str=base.PROJECT_READER,
9292
description="""Show action details for a server.""",
9393
operations=[
9494
{
9595
'method': 'GET',
9696
'path': '/servers/{server_id}/os-instance-actions/{request_id}'
9797
}
9898
],
99-
scope_types=['system', 'project'],
99+
scope_types=['project'],
100100
deprecated_rule=DEPRECATED_INSTANCE_ACTION_POLICY),
101101
]
102102

‎nova/policies/ips.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
ips_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'show',
27-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
27+
check_str=base.PROJECT_READER,
2828
description="Show IP addresses details for a network label of a "
2929
" server",
3030
operations=[
@@ -33,18 +33,18 @@
3333
'path': '/servers/{server_id}/ips/{network_label}'
3434
}
3535
],
36-
scope_types=['system', 'project']),
36+
scope_types=['project']),
3737
policy.DocumentedRuleDefault(
3838
name=POLICY_ROOT % 'index',
39-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
39+
check_str=base.PROJECT_READER,
4040
description="List IP addresses that are assigned to a server",
4141
operations=[
4242
{
4343
'method': 'GET',
4444
'path': '/servers/{server_id}/ips'
4545
}
4646
],
47-
scope_types=['system', 'project']),
47+
scope_types=['project']),
4848
]
4949

5050

‎nova/policies/networks.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
networks_policies = [
3939
policy.DocumentedRuleDefault(
4040
name=POLICY_ROOT % 'list',
41-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
41+
check_str=base.PROJECT_READER,
4242
description="""List networks for the project.
4343
4444
This API is proxy calls to the Network service. This is deprecated.""",
@@ -48,11 +48,11 @@
4848
'path': '/os-networks'
4949
}
5050
],
51-
scope_types=['system', 'project'],
51+
scope_types=['project'],
5252
deprecated_rule=DEPRECATED_POLICY),
5353
policy.DocumentedRuleDefault(
5454
name=POLICY_ROOT % 'show',
55-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
55+
check_str=base.PROJECT_READER,
5656
description="""Show network details.
5757
5858
This API is proxy calls to the Network service. This is deprecated.""",
@@ -62,7 +62,7 @@
6262
'path': '/os-networks/{network_id}'
6363
}
6464
],
65-
scope_types=['system', 'project'],
65+
scope_types=['project'],
6666
deprecated_rule=DEPRECATED_POLICY),
6767
]
6868

‎nova/policies/quota_sets.py‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@
2424
quota_sets_policies = [
2525
policy.DocumentedRuleDefault(
2626
name=POLICY_ROOT % 'update',
27-
check_str=base.SYSTEM_ADMIN,
27+
check_str=base.PROJECT_ADMIN,
2828
description="Update the quotas",
2929
operations=[
3030
{
3131
'method': 'PUT',
3232
'path': '/os-quota-sets/{tenant_id}'
3333
}
3434
],
35-
scope_types=['system']),
35+
scope_types=['project']),
3636
policy.DocumentedRuleDefault(
3737
name=POLICY_ROOT % 'defaults',
3838
check_str=base.RULE_ANY,
@@ -46,37 +46,46 @@
4646
scope_types=['system', 'project']),
4747
policy.DocumentedRuleDefault(
4848
name=POLICY_ROOT % 'show',
49-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
49+
# TODO(gmann): Until we have domain admin or so to get other project's
50+
# data, allow admin role(with scope check it will be project admin) to
51+
# get other project quota. We cannot use PROJECT_ADMIN here as
52+
# project_id passed in request url is used as policy targets which
53+
# would not match with context's project_id fetched for rule
54+
# PROJECT_ADMIN check.
55+
check_str='(' + base.PROJECT_READER + ') or role:admin',
5056
description="Show a quota",
5157
operations=[
5258
{
5359
'method': 'GET',
5460
'path': '/os-quota-sets/{tenant_id}'
5561
}
5662
],
57-
scope_types=['system', 'project']),
63+
scope_types=['project']),
5864
policy.DocumentedRuleDefault(
5965
name=POLICY_ROOT % 'delete',
60-
check_str=base.SYSTEM_ADMIN,
66+
check_str=base.PROJECT_ADMIN,
6167
description="Revert quotas to defaults",
6268
operations=[
6369
{
6470
'method': 'DELETE',
6571
'path': '/os-quota-sets/{tenant_id}'
6672
}
6773
],
68-
scope_types=['system']),
74+
scope_types=['project']),
6975
policy.DocumentedRuleDefault(
7076
name=POLICY_ROOT % 'detail',
71-
check_str=base.PROJECT_READER_OR_SYSTEM_READER,
77+
# TODO(gmann): Until we have domain admin or so to get other project's
78+
# data, allow admin role(with scope check it will be project admin) to
79+
# get other project quota.
80+
check_str='(' + base.PROJECT_READER + ') or role:admin',
7281
description="Show the detail of quota",
7382
operations=[
7483
{
7584
'method': 'GET',
7685
'path': '/os-quota-sets/{tenant_id}/detail'
7786
}
7887
],
79-
scope_types=['system', 'project']),
88+
scope_types=['project']),
8089
]
8190

8291

0 commit comments

Comments
 (0)